This issue was discovered by Chris Meyers (Red Hat).

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn